Getting Data In

Can I run the universal forwarder with a 4.1x indexer?

sf_user_199
Path Finder

Can I run a 4.2 universal forwarder with a 4.1x indexer, and a 4.1x deployment server?

We are in the process of upgrading to 4.2, but it will take some time to do the entire tier, and I'd rather not have to install forwarders twice.

Our specific setup would be 4.2 universal forwarder > 4.1x forwarder > 4.1x indexers < 4.1x search head

All of these servers are controlled a separate 4.1x deployment server.

Tags (1)
1 Solution

Brian_Osburn
Builder

Yup, that should work.

When I upgraded to 4.2 from 4.1.x, I upgraded my forwarders to the UF and it worked fine.

Brian

View solution in original post

Brian_Osburn
Builder

Yup, that should work.

When I upgraded to 4.2 from 4.1.x, I upgraded my forwarders to the UF and it worked fine.

Brian

Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...